tutorial
Interactive ~5-minute walkthrough of the Carta CRM plugin. Covers plugin overview, setup verification, how to kick off each skill, and a demo walkthrough of 4 realistic CRM scenarios. Trigger phrases: "carta crm tutorial", "show me the crm tutorial", "how do I use carta crm", "walk me through carta crm", "getting started with crm", "demo carta crm", "crm tutorial"
Security
2 findings — 1 high severity, 1 medium severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
Insecure credential handling detected (high risk: 1.00). The tutorial explicitly instructs the user to copy and paste the full browser redirect URL back into Claude to complete auth, which can contain OAuth codes or tokens and thus requires the LLM to receive secret values verbatim.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.90). The tutorial explicitly instructs the agent to "pull in public data for that domain" during Demo Scenario 4 and earlier notes that enrichment "automatically fills in ... from public data" (i.e., fetching third-party public website/domain data), which the agent then previews and may apply to records—exposing it to untrusted third‑party content that can influence actions.
- Repository
- carta/plugins
- Commit
78eff87
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.